CVE-2022-23303

Vulnerability

The Simultaneous Authentication of Equals (SAE) handshake in hostapd before 2.10 and wpa_supplicant before 2.10 is vulnerable to side-channel attacks due to cache access pattern leakage. This issue is an incomplete fix for CVE-2019-9494 [1][2]. The vulnerability affects all versions prior to 2.10, where the implementation of SAE (and EAP-pwd) uses variable-time operations (e.g., modular exponentiation and curve point validation) that depend on the password-derived secret, allowing an attacker to observe timing differences through cache side channels [3].

Exploitation

An attacker must be on the same physical machine or have access to a privileged execution context (e.g., via a malicious co-located process) to observe cache-latency variations. The attacker does not need network proximity to the victim; they only need to capture one successful SAE authentication exchange and then run a series of candidate passwords through the same vulnerable software path. By measuring the execution time of the password derivation (e.g., the PWE computation) for each candidate, the attacker can correlate timing differences to identify the correct password without brute-forcing the full space on the network [3].

Impact

Successful exploitation allows an attacker to recover the SAE password (and thus the WPA3-Personal passphrase or WPA2-PSK) used in the authenticated network. This leads to a complete compromise of network confidentiality, as the attacker can then decrypt all captured traffic and impersonate any client or access point. The attack is offline and does not require further network interaction once the trace is obtained.

Mitigation

The fix is included in hostapd and wpa_supplicant version 2.10, released on 2022-01-12 [2][3]. Patches applying constant-time operations for the PWE derivation were provided in the w1.fi security advisory [3]. Gentoo Linux provides updated packages >=net-wireless/wpa_supplicant-2.10 and >=net-wireless/hostapd-2.10 [2]. No workaround exists for versions prior to 2.10; upgrading is mandatory. This CVE is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.